An out-of-bounds array read in the octeontx2‑af CGX driver occurs when the RESP_LINKSTAT_SPEED value exceeds the 12th index of the cgx_speed_mbps array. Because the array contains only 13 elements, accessing indices 13‑15 can expose kernel memory or cause a hard‑kernel fault, depending on the data read. The vulnerability is a classic bounds‑checking failure, classified as CWE‑125 and CWE‑129, and the CVSS score of 7.8 reflects a high risk of information leakage with the possibility of a denial‑of‑service outcome.

Linux kernel implementations that ship the octeontx2‑af CGX driver without the patch are affected. All distributions containing this driver code under any kernel version prior to the commit adding the bounds check suffer the defect. No specific version range is listed, so any kernels compiled with the old driver code are susceptible.

The EPSS score of less than 1 % indicates an exceedingly low likelihood of real‑world exploitation to date. The vulnerability is not listed in CISA’s KEV catalog, implying that no publicly known exploits have been observed. Based on the description, it is inferred that an attacker would need the capacity to cause the driver to process a RESP_LINKSTAT_SPEED response with a value outside the valid range, which could be enabled by local or remote interaction with the affected network interface. While the flaw can leak kernel data or crash the system, the low exploitation probability and absence of known exploits keep the immediate risk relatively contained.